⚙️ CVE-2025-11391 - Unauthenticated Blind SQL Injection in PPOM for WooCommerce

Детали:

Plugin: PPOM for WooCommerce
Affected Versions: <= 33.0.15
Patched Version: 33.0.16
Vulnerability Type: Unauthenticated Time-Based Blind SQL Injection
CVE ID: CVE-2025-11391

Уязвимый код (classes/plugin.class.php):

function get_product_meta( $meta_id ) {
    // ...
    global $wpdb;
    $qry = 'SELECT * FROM ' . $wpdb->prefix . PPOM_TABLE_META . " WHERE productmeta_id = $meta_id";
    $res = $wpdb->get_row( $qry );
    return $res;
}

💻 Repo + PoC

#cve #wordpress #sqli

✈️ Whitehat Lab 💬Chat